SydebySyde error - event 33?

[Cecilia]

Hello, I'm new here and just installed Windows 7 for the first time a couple of days ago.

I was checking the event log and noticed 4 errors in it. All origined from SydebySyde. Here's the description, though it's in spanish:

Error al generar el contexto de activación para "C:\Windows\System32\systemcpl.dll". No se encontró el ensamblado dependiente Microsoft.Windows.Common-Controls,language="*",processorArchitecture="*",publicKeyToken="436865772d574741",type="win32",version="6.0.0.0". Use sxstrace.exe para obtener un diagnóstico detallado.

Quick translation:
"Failed to generate the activation context to ""C:\Windows\System32\systemcpl.dll"." Could not find dependent assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="*",publicKeyToken="436865772d574741",type="win32",version="6.0.0.0".
Use sxstrace.exe for detailed diagnosis.

Is this bad? I'll appreciate any help. Thanks!

ETA: I also got a few others:

 

[Slartybart]

What Anti-virus program do you have?
Please run a full scan and then download and full scan your system with Malwarebytes.

edit: also please fill in the information about your computer on your Sevenforums profile.
click on the Easy system Profile link in my signature , download the tool and let it do the work for you.

 

[Cecilia]

What Anti-virus program do you have?
Please run a full scan and then download and full scan your system with Malwarebytes.

edit: also please fill in the information about your computer on your Sevenforums profile.
click on the Easy system Profile link in my signature , download the tool and let it do the work for you.

Hi.
I did a full re-installation because I was worried and I had just installed the OS 2 days before.
I still have 3 errors (so far) from WMI (event id: 10). Not sure what that is.

I can't see the error now, but I was wondering if it has anything to do with Ad-Aware's add-on for Firefox... maybe I'm totally off, just a random guess. I'd like to know its origin though.
I use AVG 2013. I will download Malwarebytes anyway.

Thanks, I just filled it out

 

[Slartybart]

Probably the best to do since it was a recent install anyway.

I doubt Ad-Aware was the source.

Malwarebytes is a good companion to any real-time AV program. It is only a scanner though - you have to run it manually or schedule a task (task scheduler) to run periodically. I just run it manually if I think there's a reason.

post the results of Malwarebytes so that folks on this side of your monitor know your system is clean.

Thanks for filling in your specs - hmmmmm, there's no manufacturer or model. would you mnd entering that information by hand. It will help anyone here research fixes if you have to return here for help.

Thanks again,

Bill
.

The old WMI error 10 eh? Run the MS Fixit in this article.

 

[Cecilia]

Oops, I meant adblock plus not ad-aware. My head is a mess
Oh, I'm sorry, manufacturer or model of what?

Sure, here you go: Though it's in spanish

Malwarebytes Anti-Malware (PRO) 1.65.1.1000
Malwarebytes : Free anti-malware download

Versión de la Base de Datos: v2012.10.29.13

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Cecilia :: CECILIA-PC [administrador]

Protección: Habilitado

29/10/2012 11:29:55 p.m.
mbam-log-2012-10-30 (00-14-02).txt

Tipos de Análisis: Análisis Completo (C:\|H:\|)
Opciones de análisis activado: Memoria | Inicio | Registro | Sistema de archivos | Heurística/Extra | Heurística/Shuriken | PUP | PUM
Opciones de análisis desactivados: P2P
Objetos examinados: 228469
Tiempo transcurrido: 43 minuto(s), 41 segundo(s)

Procesos en Memoria Detectados: 0
(No se han detectado elementos maliciosos)

Módulos de Memoria Detectados: 0
(No se han detectado elementos maliciosos)

Claves del Registro Detectados: 0
(No se han detectado elementos maliciosos)

Valores del Registro Detectados: 0
(No se han detectado elementos maliciosos)

Elementos de Datos del Registro Detectados: 0
(No se han detectado elementos maliciosos)

Carpetas Detectadas: 0
(No se han detectado elementos maliciosos)

Archivos Detectados: 1
C:\Users\Cecilia\AppData\Local\Temp\Rar$EX00.687\CW.eXe (Hacktool.ChewWGA) -> No se tomaron medidas.

fin)

ETA: The sydebysyde error is back

 

[Slartybart]

Manufacturer and model of your PC

Check Malwarebytes settings. It found the bug but took no action. The default action should be to quarantine the Malware.

If it's already set that way, then just go to the next step below.

Read and follow this to get rid of Hacktool.ChewWGA

It's 01:30 here, so I'm going to bed. Go ahead and do the above and post the Microsoft Security Essentials (MSE)scan results. You should disable or uninstall AVG while MSE runs. You might consider replacing AVG anyway - it didn't catch ChewWGA.

Bill
.

 

[Cecilia]

I'm not sure how to get that information :/

Thanks, I did a clean reinstall again (I know, I know) and it's gone. No problems with SydebySyde so far, I do have some others, but that one is gone... I think.
Thanks for your help.

 

[Slartybart]

My first question is.... did you complete the process described in
Read and follow this to get rid of Hacktool.ChewWGA before you decided to reinstall. I hope you did.

My second question is... did you reinstall Malwarebytes and run a full scan. I think you had a question about Malwarebytes settings.

Look at Malwarebytes settings tab. There are 4 subtabs: General | Scanner | Updater | Scheduler

On the Scanner Settings subtab, make sure all checkboxes are ticked, and all drop down boxes have a default action of "Show in results list and check for removal"
On the Updater settings subtab, tick the first two checkboxes "Download and install...." and "Notify me when a program update....."
​

Please run a full Antivirus scan using the free ESET Online Scanner (requires Internet Explorer as a platform to run) and if you haven't already done so, please run a full scan with Malwarebytes.

What "other" errors are you seeing and where do you see them. If there's a bug on your system, you need to make sure your system is clean before re-installing. Otherwise it could be a vicious circle.

Post the results of both scans and tel me about the "other" errors.

You can always fix the WMI error using the MS Fixit I previously posted.

I'm not sure how to get that information :/

Thanks, I did a clean reinstall again (I know, I know) and it's gone. No problems with SydebySyde so far, I do have some others, but that one is gone... I think.
Thanks for your help.

 

[Cecilia]

I'm running ESET now, I tried it a few days ago but it froze on step 2. I'll post both results as soon as they're done.

These "errors":

 

[Slartybart]

I don't speak or read Spanish, or come to think of it, any language other than English; and even that's a struggle sometimes .

It's probably best if you translate any output, reports or screenshots you post to English, so more people on this forum understand the information. You can use Google Translate on some things, but not images. If the application has a save report or export to text, then you can use Google. Otherwise we'll have to rely on you to make the effort.

It's also better to say where you observe things on your computer, hence I asked "What 'other' errors are you seeing and where do you see them. " I had to look at the image more than one time before I realized you were showing the Event log. It would have been better to say "I see these errors in the Event log". Then I could tell you to export the events or produce a System Information file (which contains the events). Still there's the language barrier.

There's an easy way to toggle languages on windows using the Language bar. Let me think on this or ask for help. It should be relatively easy to set up, but I'd like to give you step-by-step instructions or have someone who has done it join the conversation.

 

[Slartybart]

I've asked folks for help on Windows language resources. Would you want to try an experiment?
Type System Information in the start menu search box and hit enter.
Let the report be generated and then save it. You should have created a .NFO file.
Navigate to the folder where you saved the .NFO file and right click any open area of the folder windows,
then select New, then create a compressed (zipped) folder.
Drag .NFO file to the newly created zip folder, and
post an entry on this thread and attach (paper clip on post menu) the zip folder

I'm curious if System Information (SI) is written in the locale language or if it contains codes whose messages are displayed in the locale of the machine reading the .NFO. I'm sure that a lot of the information is just text and that will in in the language of the machine that generated the report. But other things, such as events, might simply be a code that will be converted to the language of the machine reading the output.

If you want to experiment with language even more - search Windows help for: Install a display language
then follow the instructions to add English (United States) to your language options.

From Windows help:

Install a display language
You can change the language Windows uses to display text in wizards, dialog boxes, menus, and other items in the user interface. Some display languages are installed by default; others require you to install additional language files.

Before you can install a display language, you need access to the language files. These files can be on your computer, on a computer on your network, or on your Windows DVD; or they can be downloaded from the web. For more information, see How do I get additional language files?


To install a Language Interface Pack (LIP), double-click the file to open the setup program. To install a Multilingual User Interface Pack (MUI), follow these steps:

1. Click to open Regional and Language Options.
2. Click the Keyboards and Languages tab.
3. Under Display Language, click Install/uninstall languages, and then follow the steps.
   If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
4. Note: The Display language section will only be visible if you have already installed a LIP or if your edition of Windows supports MUI. MUI packs are only available in Windows Vista Ultimate and Windows Vista Enterprise.

After you install a display language, you need to set your computer to use that language. For more information, see Change the display language.

---

Change the display language

The display language is the language that Windows uses in wizards, dialog boxes, menus, Help and Support topics, and other items in the user interface. Some display languages are installed by default, and others require you to install additional language files. When you change the display language, it is changed for your user account and is not changed on the Welcome screen. If you want to set the display language for multiple users or the Welcome screen, see Apply regional and language settings to reserved accounts.

1. Click to open Regional and Language Options.
2. 
   Click the Keyboards and Languages tab.
3. Under Display language, choose a language from the list, and then click OK.
   Note: If you don't see the list of display languages, you need to install additional language files first. For more information, see Install a display language.

When you change the display language, the text in menus and dialog boxes for some programs might not be in the language that you want. This happens because the program might not support Unicode. For more information about changing the text in menus and dialog boxes for programs that do not support Unicode, see Change the system locale.

---

​

This isn't going to affect the issue you reported, but it might help resolve it since more members can read the output. Then again, it might not affect reports that have already been generated, - in that case, you'd have to leave the locale English until new events were generated. as I said, I'm not a language expert.

Thanks

 

[Cecilia]

Oh, sorry about that. I didn't realize. Yes, I meant errors in the event log. My apologies.
I didn't think of translating it because the event number is the same no matter the language... or I think so?

Anyway, I ran ESET online scanner and the results are in english (see attachement).

The infected files it discovered was a .rar I had with a software. I actually had two copies of it because I have some folders backed-up on another drive. It has been removed.

I ran Malwarebytes a few times. First I tried to do a full scan of the two drives I have, which are both particioned in two (which I guess that would make 4 total). It took over 5 hours and I had to stop it because it got really slow, maybe the fact I was using the computer while the scan was on, didn't help. Anyway, in those 5 hours it didn't find any threats.
Then I scanned C: & F:, which are all one drive (particioned, obviously) and it got slow while scanning HTML files (which I know are safe). Now I scanned C alone which is where the System files are on.


Malwarebytes Anti-Malware (PRO) 1.65.1.1000
Malwarebytes : Free anti-malware download

Version of the Database: v2012.11.02.08

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Cecilia :: CECILIA-PC [administrator]

Protection: Enabled

02/11/2012 18:20:07
mbam-log-2012-11-02 (18-20-07). txt

Types of Tests: Full Scan (C: \ |)
Scan options enabled: Memory | Home | Registry | File System | Heuristics / Extra | Heuristics / Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 235137
Time elapsed: 41 minute (s), 42 second (s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values ​​Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Detected Files: 0
(No malicious items detected)

end)

 

[Slartybart]

Ok fair enough - the error numbers aren't language specific 10 is 10

I'm a bit concerned about two things.
1) ESET found and removed two bugs - that's good
2) Malwarebytes took 5 hours.

The C: drive scan finished in about 43 minutes, seems normal. And no threats found - that's good.

How long did the ESET scan take?
Did the ESET scan run on all drives?
I know ESET takes a long time, so I'm curious as a comparison to Malware bytes time. I'm asking because if ESET scanned all drives in less time than Malwarebytes, I'm surprised

How big are your drives again?

Can you run a quick Malwarebytes on all drives?
Can you expand the ESET list of threats found.

I can't stress enough how more information let's people here provide you with better resolutions. You did say what ESET found "The infected files it discovered was a .rar I had with a software. I actually had two copies of it because I have some folders backed-up on another drive. It has been removed.", but .rar doesn't give folks much to research. The ESET log should provide specific information that identifies the threat, the severity of the threat and possibly further action required. At the minimum, the log will provide a full name so others can research it, determine if a deeper or different removal process is required.

I'm going on the assumption that more needs to be done.
Please follow the instructions here: Windows Defender Offline

You've reinstalled twice and still having problems, no doubt because there's something on your system. ESET removed two, but there might be more. Run the WDO and see what it finds and cleans. Between ESET, Malwarebytes, and WDO your system should be clean. There is one additional tool I might suggest after WDO.

So, try a quick scan with Malwarebytes on all drives - post the results, just as you did for the C: drive.
Then create a WDO disk on a machine that's clean of malware and boot your machine form the disc and run a full scan.

And here's an easy one - WMI code 10. Did you run the MS Fixit?

Thanks,

Bill
.

 

[Cecilia]

I'm sorry, I just forget some stuff when posting. Like the drives' capacity, etc.

The ESET scan took 2 hours and 56 minutes, I guess it scanned everything if it took that long. I forgot to mention that the C and D drive are almost empty but the E and F are almost full. The whole drive is about 80 GB and there are 2 GB free or so. Maybe that's why it takes that long?

The C and D drives are 150GB, but as I said, they aren't even half full atm.

The ESET long said this:
E:\Cecy\Cecy 2\Cosas Descargadas 6\RAR\UltraISO.Premium.v9.3.3.2685.Multilenguaje.Retail.Incl.Keygen.CORE.OR.ZWT-Reg.rar a variant of Win32/Keygen.AG application deleted - quarantined
F:\Cecy Back-up\Cosas Descargadas 6\RAR\UltraISO.Premium.v9.3.3.2685.Multilenguaje.Retail.Incl.Keygen.CORE.OR.ZWT-Reg.rar a variant of Win32/Keygen.AG application deleted - quarantined

And looking at that, yes, it scanned everything because those files were on the other drives.

I mentioned that after I removed the ChewWGA and reinstalled I didn't have the SideBySide problem anymore, just those I showed on the event log, and I only discovered those because I checked the log. Checking it again, the only consisting error I find is that of WMI.

No, I haven't run the fix yet, I wanted to see if there was anything else.

I'll run MalwareBytes on the other two drives and post it here.

Thanks.

 

[Slartybart]

ESET ran almost 3 hours and finished.
Malwarebytes ran 5 hours and you stopped it.

That doesn't seem right - it takes a while for Malwarebytes to run, but 2 hours longer than ESET and not done..... hmm. I suppose it could have almost been finished. We'll forget a full scan with Malwarebytes (do the quick scan) for now since WDO is the next tool in the arsenal.

Yes, ChewWGA was removed and no SxS errors after re-install. But there is something on your machine and we (you and I and other members) will make sure you have a clean machine.

Win32\KeyGen information.

You can run the MS Fixit anytime - you know where to get it and how to run it.
It is a one-time fix.... run it once and the events aren't reported any more.... unless you do an install =:>

Thanks for the additional information from the ESET log - I'll see what the threat level is and if there are special tools or other considerations required.
Note though it will take longer because........language. I'll do the Google translation once more, but next time I'll ask you to do it. And you have been doing so well..

I tried to understand your explanation of capacity, but the order threw me off. Probably the language thing again.

OK, how about this. Post a screen shot of your computer showing disk capacity

 

[Slartybart]

You've had two threats on your machine - both are keygens.

Where did you get your copy of Windows? Are you the only person using that machine?

 

[Cecilia]

My brother gave it to me. I wanted to re-install XP but he gave me Seven.

Windows Defender Offline seems tricky to use, I'm sorry to ask, but is there another tool to try... maybe easier to use?

Here's the screen:
Both in red are one same hard drive particioned in two and the ones in blue are the other hard drive also particioned. That's what I was trying to explain, sorry about that. I learned most of my english by myself, is not by any means perfect.

 

[Slartybart]

Tell your brother that he most likely gave you install media that had Malware on it.

Where did you get the Key, from your brother also? If your machine had XP on it, you can't just slap Win7 on it using the XP COA key - you have to have a valid license, otherwise you'll need to purchase a license key from Microsoft.

So, if Win7 key you have is a hacked key, you have a few options
1) Re-install XP as you wanted to do before your brother helped you. Assuming that you have the disks and a valid key (COA sticker on the machine)
2) forget Win7 and purchase a Win8 license
3) run MGAdiag to resolve the Win7 questions.

While I'd like to see you get to Win7, it will cost you if you don't have a valid key

WDO or any other offline scanner require the same steps - download, put to disc, boot from disc, run.

Thanks for the screen, that clears up my confusion.

So far your English is great. You can use Google Translate for any text reports, that way you don't have to work so hard - just paster the text into the left side and translate to English, then copy the output to your post.
Images, well we can work on that - I'll probably ask you to translate some stuff for the forum - but as you said, numbers are numbers.

Let me know what you want to do.

 

[Cecilia]

What do you mean? Because of the ChewWGA? I can't see any Malware now. I think it was that, the activation hack. He gave me that too. I have not used it again after the last re-install.
I have to say I have grown quite fond of Seven now. I don't think Win8 would run well on my computer, and I have to say don't particulary like the changes ; )

Oh, I know of Google Translate, thank you. I use it whenever I have any doubts writing something in english. It's no work for me, I mostly use the english language while online

I ran MalwareBytes once more on that other partioned drive (D: & E:, EXCEPT this time I didn't scan that 300 MB folder of HTML files I have in one of them. Here are the results:

Malwarebytes Anti-Malware (PRO) 1.65.1.1000
Malwarebytes : Free anti-malware download

Database version: v2012.11.03.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Cecilia :: CECILIA-PC [administrator]

Protection: Enabled

03/11/2012 13:07:04
mbam-log-2012-11-03 (13-07-04).txt

Scan type: Full scan (D:\|E:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 271690
Time elapsed: 1 hour(s), 41 minute(s), 14 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

I have one unrelated question, if that's okay. In one of the partitions (D: to be exact) I have installed XP from when I only had that drive. I never managed to delete it. Can the files be deleted as you might delete a simple folder? Or is there any procedure to be done?

 

[Slartybart]

Please follow the instructions in the MGdiag tutorial to provide more information about your Win7 install.

Ok, Malwarebytes looks good, it ran in relatively short time. Since there were malware on your system, I suggest running Malwaresbytes again. Full scan | Full System. You and i do not know where any threats might be located, Malwarebytes will scan the system and check it. - DO NOT exclude any drives or folders.

Run it over night if you have to, but let the software do it's job.

Sure, questions are ok.
I'm guessing the D: drive is the original recovery partition when you had XP.
Leave it there for now and please post a Disk Management screen shot.

Expand the Disk manger to give the most detail (close the right pane, select disk management, close the left pane, and maximize the window, then Alt+Prtsc, open paint, paste the captured image, and post it here)

Thanks
.